From 47a640119232d69c5bc467b6a5fef60cab52b42f Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Sat, 8 Aug 2026 03:14:19 -0400 Subject: [PATCH] chore(claude-lanes): re-pin the review lanes to ci-workflows v0.10.2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both lane callers here are `locally-owned` in the standards sync manifest — this is the org's one PUBLIC caller target, and runner-policy forbids a public repository from referencing the governed select-runner indirection — so the pins are bumped in this repository rather than arriving by sync. v0.10.2 is `e94438746c300b02385a7f8a2a2dcd19a7f4ad4a`. Neither reusable changes its input names, secret key set, `runs-on`, or caller-permission surface against v0.9.1, so the callers need no edit beyond the pin. BLOCKED on the policy sync. `.github/standards/runner-policy/policy.json` is a MANAGED materialization and is deliberately not touched here; it still approves only `c136b27f`, so the gate fails closed on the new SHA: runner-target-contract: the reusable workflow path@SHA has no reviewed runner-input contract (auto-approval declined: inputs changed since the previously reviewed ...@1d3762c2) melodic-software/standards#337 adds the v0.10.2 contracts. This branch goes green only once that merges and its sync PR delivers the updated policy.json here. Ref: melodic-software/standards#337 Co-authored-by: Claude Opus 5 (1M context) --- .github/workflows/claude-review.yml | 2 +- .github/workflows/claude-security-review.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml index 8be2703d3..27d0caa74 100644 --- a/.github/workflows/claude-review.yml +++ b/.github/workflows/claude-review.yml @@ -32,7 +32,7 @@ jobs: concurrency: group: claude-review-${{ github.repository }} queue: max - uses: melodic-software/ci-workflows/.github/workflows/claude-review.yml@c136b27f404dd32ce3873f39a6f3443891d1c16e # v0.9.1 + uses: melodic-software/ci-workflows/.github/workflows/claude-review.yml@e94438746c300b02385a7f8a2a2dcd19a7f4ad4a # v0.10.2 with: runner: ubuntu-24.04 # Pass only the one named secret (least privilege) rather than `secrets: diff --git a/.github/workflows/claude-security-review.yml b/.github/workflows/claude-security-review.yml index 923c8707f..65c80c181 100644 --- a/.github/workflows/claude-security-review.yml +++ b/.github/workflows/claude-security-review.yml @@ -31,7 +31,7 @@ jobs: contents: read # checkout + read the diff pull-requests: write # post the security review id-token: write # OIDC — mints the Claude GitHub App token - uses: melodic-software/ci-workflows/.github/workflows/claude-security-review.yml@c136b27f404dd32ce3873f39a6f3443891d1c16e # v0.9.1 + uses: melodic-software/ci-workflows/.github/workflows/claude-security-review.yml@e94438746c300b02385a7f8a2a2dcd19a7f4ad4a # v0.10.2 with: runner: ubuntu-24.04 paths-file: .github/claude-security-paths